Fintech & digital payments rules in United Kingdom (2026)

SI 2026/102 creates the comprehensive FCA licensing regime for cryptoasset activities — including stablecoin issuance, operating trading platforms, dealing, and arranging — with full commencement on 25 October 2027 and firm applications opening September 2026. This is the foundational statute for the UK's end-state crypto regulatory framework.

Sets out the government's ambition for a 'trusted, world-leading payments ecosystem on next-generation technology,' establishing a cross-authority Payments Vision Delivery Committee chaired by HM Treasury and issuing formal recommendations to the FCA and PSR to streamline the fragmented regulatory landscape. Marks the first overarching political strategy for the UK payments sector post-Brexit.

The CMA declared all nine mandated banks (including Bank of Ireland and Danske) had implemented the full suite of open banking payment and account-information services required under the 2017 Order, closing the original mandate and transitioning oversight to the new Joint Regulatory Oversight Committee. Signals the end of the compulsory build phase and the start of a commercially-led open finance era.

Under PS23/6, all firms marketing cryptoassets to UK consumers — including overseas firms — must comply with financial promotion rules classifying crypto as a 'Restricted Mass Market Investment': mandatory risk warnings, a 24-hour cooling-off for first-time investors, and a ban on refer-a-friend bonuses. The FCA immediately began enforcement, including legal proceedings against HTX for illegal promotions.

Expands the regulatory remits of the Bank of England, FCA, and PSR to cover 'digital settlement assets' (including sterling stablecoins) used for payment, enabling HM Treasury to bring systemic stablecoin payment systems within the existing payments regulatory perimeter. Also repeals retained EU financial services law, giving UK regulators rule-making powers post-Brexit.

The Money Laundering Regulations 2017 (as amended) came into force requiring all cryptoasset exchange providers and custodian wallet providers to register with the FCA for AML/CTF compliance — the UK's first mandatory crypto registration regime. Existing businesses had until 10 January 2021 to obtain registration; the FCA registered far fewer firms than applied, blocking many from operating.

SI 2017/752 transposed the EU's revised Payment Services Directive into UK law, introducing authorisation requirements for Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs), mandating open API access to bank accounts, and requiring strong customer authentication. This created the legal backbone for third-party fintech access to consumer banking data.

The CMA ordered the nine largest current-account providers (CMA9) to establish and fund the Open Banking Implementation Entity (OBIE) and deliver standardised open APIs for account data and payments by specified deadlines. This was the world's first regulatory mandate for open banking and directly enabled the UK's fintech ecosystem to scale on bank-held data.

As part of Project Innovate, the FCA opened its regulatory sandbox to applications, accepting 24 of 69 firms in Cohort 1 and approving 18 testing plans by October 2016. The sandbox allows fintech firms to test novel products under restricted authorisation and bespoke waivers, removing a key licensing barrier to innovation and establishing a model replicated globally.

Created under the Financial Services (Banking Reform) Act 2013, the PSR became the UK's first independent economic regulator dedicated solely to payment systems, with statutory objectives to promote competition, innovation, and the interests of service users. It gained concurrent competition powers with the CMA and direct access regulation over Bacs, CHAPS, Faster Payments, and card schemes.

The Act established the legal basis for the PSR, designated specific payment systems for regulatory oversight, and introduced access and pricing rules for interbank infrastructure in response to the Payments Council review. It restructured the institutional landscape governing UK payments infrastructure for the first time since the Banking Act 1979.

Transposed the EU's Second E-Money Directive, replacing the 2009 e-money rules and introducing a two-tier system of 'authorised' and 'small' electronic money institutions with distinct capital and safeguarding requirements. This created the primary licensing pathway used by mobile wallets, prepaid card firms, and digital payment fintechs operating in the UK.

Transposed EU Payment Services Directive 2007/64/EC, for the first time requiring firms providing payment services (money transfer, card acquiring, issuing) to be authorised or registered with the FSA (later FCA), with rules on transparency, liability, and consumer protection. Established the foundational perimeter that all subsequent UK payments regulation has built upon.